If you want to pass data into an iFrame, you need to send it in a parameter called "app_data" - all other parameters will get removed. This app_data gets sent in the "signed request" so you need to decode the signed_request. Details http://developers.facebook.com/docs/authentication/signed_request/ (Again, use the facebook SDK as it makes handling the signed request easy!).